Description

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

Remediation

References

CVE-2020-28949

Related Vulnerabilities

WordPress Plugin Infographic Maker-iList Unspecified Vulnerability (2.7.0)

WordPress Plugin Mass Pages/Posts Creator Cross-Site Scripting (1.2.2)

ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-5866)

WordPress Plugin Comment Rating Cross-Site Request Forgery (2.9.20)

PostgreSQL Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2019-9193)

Severity

High

Classification

CVE-2020-28949 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities